Security Hardening : Devices Without Recent Antivirus Scan
This query identifies onboarded devices in the environment that have not completed a successful antivirus scan within the last 30 days. It provides visibility into endpoint compliance, ensuring that all devices are actively monitored and protected by Microsoft Defender or other antivirus solutions. Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
Microsoft Sentinel (KQL)
